DEA-C01 Data Security and Governance Practice Question
A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location
When using Lake Formation, you should grant permissions only through Lake Formation and remove any IAM policies that allow direct S3 access. This ensures that users cannot bypass Lake Formation's fine-grained access controls. Option A (S3 Access Points) can restrict access but does not inherently enforce Lake Formation-only access unless properly configured with a policy that specifically allows only Lake Formation, which is more complex and not the recommended approach. Option C (S3 Block Public Access) only prevents public access but does not prevent authorized IAM users from direct access. Option D (bucket policy denying all except Lake Formation) could work but is not the simplest or most standard method; the recommended practice is to use Lake Formation's integration and manage permissions centrally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use S3 Access Points with a policy that restricts access to only Lake Formation
Why it's wrong here
Access Points can restrict access, but Lake Formation still requires appropriate IAM permissions; this does not fully enforce the requirement.
- ✓
Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location
Why this is correct
This ensures that the user can only access data through Lake Formation, and direct S3 access is blocked.
- ✗
Enable S3 Block Public Access on the bucket
Why it's wrong here
Block Public Access prevents public access but does not prevent authenticated users with IAM permissions from accessing S3 directly.
- ✗
Change the S3 bucket policy to deny all access except from Lake Formation
Why it's wrong here
Lake Formation does not have a specific principal; it uses IAM roles. This approach is not straightforward and may not work as expected.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.